SVG VASP License 2026

St. Vincent and the Grenadines formally entered the virtual asset regulation era on 31 May 2025, when the Virtual Asset Business Act (VABA) came into force. After years of operating as one of the most permissive offshore jurisdictions for crypto businesses — and as the go-to destination for forex and CFD companies that needed a legal entity without a regulatory burden — SVG has introduced a mandatory registration regime for all virtual asset service providers operating in or from the jurisdiction. This is a significant structural shift for thousands of companies that incorporated in SVG under the previous no-license-required framework.

This page covers the full picture of SVG VASP registration in 2026: what the law requires, what the process actually costs in practice (including fees the FSA does not advertise upfront), how SVG compares to other Caribbean crypto jurisdictions, and who should — and who should not — be pursuing this path.

What the Virtual Asset Business Act Actually Requires

The VABA defines a Virtual Asset Business (VAB) broadly, covering exchange between virtual assets and fiat currencies, crypto-to-crypto exchange, transfer services, custody and administration of virtual assets, participation in token offerings, and related financial services. Only Business Companies (BCs) and Limited Liability Companies (LLCs) incorporated in SVG are eligible to apply. Foreign entities cannot hold the registration directly — they must operate through a locally incorporated SVG entity.

The official application fee set by the FSA is EC$4,000 (approximately USD 1,480). The registration certificate, once issued, is valid until 31 December of the year of issuance and must be renewed by 31 January of the following year, with an annual renewal fee of approximately EC$12,000 (approximately USD 4,500). The FSA targets a 90-day processing window from the point all documentation is deemed complete.

The Full Document Checklist: What the FSA Actually Asks For

Based on the FSA's published Virtual Asset Business Application Checklist, applicants must submit the following to the Financial Services Authority in Kingstown, SVG:

• •Completed application form
• •Letter from an external auditor (Certified/Chartered Accountant) confirming consent to act for the applicant
• •Proof of registration as a Business Company or LLC incorporated in SVG
• •Two certified pieces of identification for the UBO, significant shareholders, directors, principal representative, and senior officers
• •Completed due diligence forms for the UBO, significant shareholders, principal representative, and directors
• •References for directors, principal representative, significant shareholders, and senior officers — one business reference and two bank references per person
• •Curriculum vitae of directors, principal representative, and senior officers, including copies of relevant educational certificates; the FSA specifically requires evidence that persons running the business have requisite knowledge and expertise in virtual asset operations
• •Acceptance letter from each director confirming consent to serve
• •Statement of assets and liabilities or net worth statement for the UBO and significant shareholders, certified by a qualified accountant or auditor
• •For existing companies: three years of audited financial statements (or since establishment date, whichever is closer); for groups, two years of consolidated audited statements
• •Police record issued within the past six months for the UBO, significant shareholders, principal representative, directors, and senior officers — certifying no criminal convictions
• •Comprehensive business plan covering: objectives and services description, target customer base, feasibility study, management and staffing structure, AML/CFT policies including cyber security and data protection, internal controls, risk management framework, group ownership structure, and five-year financial and operational projections
• •Proof of ability to meet statutory deposit requirements and evidence of source of financing
• •Evidence of adequate insurance, capital, and liquidity in accordance with Regulations 6 and 25 of the VABA
• •List of subsidiary companies (where applicable)

Following registration, and within six weeks of the registration date, the FSA also requires: professional indemnity insurance at a minimum of USD 1,000,000; a prospectus (submitted at least 14 days before proposed publication); contracts with promoters, service providers, and sub-contractors; and certified copies of any licenses required in other jurisdictions where the VASP operates.

Financial Requirements: Statutory Deposit and Capital

The statutory deposit required under the VABA is EC$100,000 (approximately USD 37,000) or 25% of the VASP's financial obligations to clients, whichever is greater. This deposit must be held in cash, government securities, or another form approved by the Minister, and serves as client protection capital rather than operating capital. Separately, the mandatory professional indemnity insurance of USD 1,000,000 represents an ongoing operational cost that applicants should budget for before beginning the process.

The MLRO and MLCO Requirement: A September 2025 Circular You Need to Know About

In September 2025 — four months after the VABA came into force — the FSA issued a formal circular to all licensed sectors reminding entities of their obligation to appoint both a Money Laundering Reporting Officer (MLRO) and a separate AML/CFT Compliance Officer (MLCO). The circular, signed by Executive Director Carla James, clarified that these must be two separate individuals unless formal FSA approval is obtained for one person to perform both functions — a practice the FSA had been finding widespread and which it confirmed is contrary to Regulation 25(5) of the AML & TF Regulations 2014.

All appointments of an MLRO or MLCO must be submitted to the FSA for prior approval before the official appointment takes effect, using the prescribed application form. Supporting due diligence documentation — CV, qualifications, proof of identity, proof of address, and police record — must accompany each appointment submission. Entities that had not yet appointed designated MLRO and MLCO officers were required to do so by November 28, 2025. VASPs that applied after this date need to factor in the cost and lead time of obtaining FSA approval for both compliance officer appointments as part of their overall application timeline.

September 2026: The FSA's Cybersecurity Evidence Requirements

In September 2026 the FSA began issuing further information requests to VASP applicants already under review. Each request asks for three things. The first is details of all wallet addresses the applicant will use in its virtual asset business. The second is the domain names, brand and trading names under which it will operate, including any website or platform through which services will be offered. The third is a completed Cybersecurity Evidence Submission Workbook, supported by an Applicant Evidence Submission Guide (version 1.0).

The first two items are straightforward. The workbook is not. It turns cybersecurity from a single paragraph in the business plan into a structured documentary review, and it is now the most demanding part of an SVG application.

What the package must contain

Applicants submit one complete, indexed baseline evidence package organised into 25 evidence groups.

The first four groups are foundational documentation. They cover the application and licensed activities, including the custody and transaction-authority model. They also cover end-to-end transaction, asset and key-management flows, from deposits and withdrawals through hot, warm and cold wallet transfers to emergency transactions. The third group is system, network and cloud architecture. The fourth is a single VASP Cybersecurity Scope statement covering every person, process, system, location and material third-party provider that supports the licensed activities, mapped against any ISO/IEC 27001, CCSS or SOC boundaries.

The next sixteen groups are policies, standards and procedures. They cover governance, policy management, risk and threat modelling, asset and cryptography management, wallet and key security, identity and privileged access, configuration and vulnerability management, secure development and change, code and smart-contract assurance, penetration testing, logging and security operations, incident response including FSA breach notification, business continuity and disaster recovery, outsourcing, personnel security, and regulatory reporting governance. The FSA's indicative schedule names more than 100 individual documents. Equivalent titles are accepted where the subject matter is clearly covered.

The final five groups are independent assurance. They cover certifications, independent penetration testing, independent code and smart-contract audits, assurance for material third-party providers, and any other regulatory or independent reviews the applicant relies on. Reports must be complete, including limitations, exclusions, open findings, management responses and retest evidence.

Policies are not enough

Each control area also requires representative business-as-usual outputs. These are records generated through normal operations, such as access reviews, reconciliation reports, vulnerability scans, restore tests, incident tickets and key-ceremony records. For an operating business these should normally cover the preceding twelve months. Pre-operational applicants submit commissioning, testing and readiness evidence instead. The FSA is explicit that certificates and audit reports cannot stand in for these records.

Controlled documents must show owner, approver, version, approval date and applicable legal entity. Operational records must show source system, generation date, period covered and entity. The package must not contain private keys, seed phrases, recovery secrets or live credentials.

How the review works

The initial review is documentary. The FSA may issue one completeness notice, after which the applicant returns a single revised package. It may then issue one consolidated clarification request, normally limited to ten questions, with an optional clarification meeting. Clarifications are submitted as separately versioned additions and must not overwrite the original filing.

The review does not certify compliance or test operating effectiveness. Sampling, interviews, configuration inspection, source-code review and technical testing are reserved for a full cybersecurity audit, which the FSA may require after the initial review. An authorised representative must sign a nine-point declaration before submission.

What this means in practice

For applicants without an existing ISO 27001 programme, a recent independent penetration test or a documented control environment, the workbook adds meaningful cost and several weeks of preparation. It also exposes inconsistencies. The FSA expects policies, diagrams, records and assurance reports to describe one coherent operating model, and gaps between what the business plan says and what the evidence shows will surface at this stage. Applicants who have already submitted should prepare for this request now rather than wait for it to arrive.

The Hidden Fees: What the FSA Does Not Advertise

This is the part that applicants repeatedly tell us caught them off guard — and that we feel it is important to document clearly, because it materially affects the real cost of SVG VASP registration.

The FSA has introduced a due diligence levy of approximately USD 3,600 per company officer as a compliance outsourcing check conducted during the VASP licensing process. This fee was not disclosed in the FSA's published checklist, is not prescribed in the VABA legislation, and was not communicated to applicants at the time of submission. Instead, applicants received requests for this payment midway through the application process — after already having compiled and submitted all documentation and paid the application fee.

For a company with three officers — which is common for even a small crypto operation — this amounts to approximately USD 10,800 in undisclosed charges alone. Applications with three to five officers are seeing total due diligence levies of USD 10,800 to USD 18,000 per application, on top of the official application fee, statutory deposit, legal preparation costs, and insurance.

This pattern is not unique to SVG. It closely mirrors what happened with the Eastern Caribbean Securities Regulatory Commission (ECSRC), where companies that applied for securities licenses in St. Lucia two to three years ago were similarly hit with USD 10,000 to USD 15,000 in compliance fees that are not prescribed in any legislation. In both cases, the structure is the same: a regulator introduces a mandatory licensing regime, publishes a formal checklist and application fee, and then introduces additional charges at the due diligence stage after the applicant is already committed to the process.

We are not suggesting the FSA is acting in bad faith. Due diligence on officers is a legitimate regulatory function, and outsourcing it to third-party background check providers has real costs. But the complete absence of disclosure — no mention in the published checklist, no indication on the FSA website, no reference in the VABA or its regulations — means applicants have no way to budget accurately before committing to the process. For a small operator, an unbudgeted charge of up to USD 18,000 midway through a 90-day application is not a minor inconvenience.

SVG VASP vs Other Caribbean Crypto Jurisdictions

The SVG VASP is a genuine regulatory authorization — it is issued by a statutory authority under enacted legislation, requires meaningful compliance infrastructure, and is not simply a certificate of incorporation with the word "VASP" on it. That distinguishes it from the pre-2025 SVG corporate structure that many operators used as an unregulated vehicle.

Within the Caribbean, the SVG VASP sits between Costa Rica VASP structures (which remain lighter-touch registration frameworks without full licensing) and the more internationally credible Mauritius FSC VASP license or Seychelles FSA VASP authorization. The SVG VASP is stronger than an unregulated corporate structure and provides a genuine regulatory credential for banking and PSP relationships. It is weaker than a Mauritius or Seychelles VASP in terms of international recognition by institutional counterparties, prime brokers, and Tier 1 banks.

For operators that currently have an SVG Business Company or LLC running crypto operations under the pre-2025 unregulated framework, the decision point is binary: apply for VASP registration under the VABA, or redomicile or restructure the operation to a jurisdiction where the activity is either not yet regulated or where the regulatory framework offers better cost-to-recognition value. We assist with both paths — honest assessment of whether SVG registration makes sense for your specific model is part of every initial consultation.

Who Is the SVG VASP Right For

The SVG VASP makes sense for operators who already have an SVG corporate structure they want to legitimize, whose operating models do not require institutional banking access or EU client relationships, and who can absorb the real total cost of the application including the undisclosed due diligence charges.

It is less appropriate for operators building institutional-grade crypto businesses that require recognised regulatory status with Tier 1 banks, prime brokers, or EU-market counterparties. For those use cases, Mauritius (FSC VASP), Cyprus (MiCA CASP), or Seychelles (FSA) provide meaningfully stronger regulatory credentials. Zitadelle AG will tell you honestly which jurisdiction fits your business model — including when SVG is not the right answer.